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Descdptfon 

This invention relates to an apparatus for moni- 
toring the use of software in a computer system 
with respect to at least one selected aspect of such 
use, the computer system having a central proces- 
sor containing the software, and the central proces- 
sor being accessed by at least one operator termi- 
nal connected to it More particularly, the invention 
relates to a combination software and hardware 
device for use with computer systems having one 
or more consoles or terminals connected to a cen- 
tral processing unit 

Computer software, programs, or packages of 
programs are often licensed by the developer or 
other supplier to the user or customer. The soft- 
ware licence may provide that, for a prescribed 
payment, the program may be used a given num- 
ber of times, or for a given number of hours, or on 
a particular computer system, or on a given num- 
ber of terminals. Licensing of software on a per 
terminal basis would be highly desirable as a con- 
venient way to distinguish small users from large 
users and adjusting payments accordingly. 

However, once tiie software is provided to tiie 
customer by the supplier, it is cunrentiy very dif- 
ficult for the supplier thereafter to control the ac- 
cess, use, or transfer of the software. It is cor- 
respondingly difficult for the supplier to police tiie 
software licence. As a result, suppliers are often 
reluctant to enter Into limited licences. The advan- 
tages of such licences, for example lower cost to 
small users or flexible pricing, are lost. 

Techniques for tiie control or protection of 
computer programs cunrentiy use either a software 
approach or a hardware approach. A hardware ap- 
proach to preventing unauthorised use of computer 
programs typically employs a physical key, such 
as a specially-coded card which must be inserted 
in a lock in the computer system before access 
can be had to the program. The key provides data, 
such as an electronic serial number or authorisation 
numt)er. The correctness of the data must be prop- 
erty verified t»efore a program can be run. Alter- 
natively, a programmable read-only memory 
(PROM) may be inserted in tiie computer system. 
The program then detects an authorisation number 
in tiie PROM to permit the program to operate. 
Another approach is to put authorisation data, such 
as a serial numtser, physically in the circuitry of the 
computer system. When the program Is Initially 
run, the autiiorisation data of the computer system 
are entered in a blank in tiie program. Thereafter, 
the program will only run if the authorisation data 
are present 

While tiie security provided to the program is 
high with the hardware approach, there are factors 
which limit its use. A msyor drawt)ack is cost, botii 



in tiie key and in the modification to the computer 
system. This has tended to limit the hardware 
approach to protection of large, expensive software 
programs. Many manufacturers do not put a serial 

6 numtier in the circuitry of the computer. Also, if tfie 
computer circuitry must be changed, there is a 
problem of getting the new authorisation data Into 
the program. Furtiier. the hardware approach is not 
particulariy well suited for situations where use of 

10 the program Is to be permitted, but under limited 
conditions. 

In the software approach to program protection, 
the program is altered by encryption techniques so 
that it is not accessible without a software key 

75 placed on the medium containing the program, 
such as a computer disc. The software approach is 
less expensive than tiie hardware approach but 
less secure. Furthermore, tiiere are several prob- 
lems in the software approach. One is tiiat It pre- 

20 vents legitimate copying as where an autiiorised 
user wishes to make a back-up copy of the pro- 
gram. A second drawback is that devices known as 
nibble copiers can duplicate alt the software on the 
disc, including tfie software key, so tfiat tiie secu- 

25 rity is greatiy compromised. Nor does the software 
approach protect against an unauthorised taking of 
the program from one computer system to another, 
since the security data are transfenred along with 
the program. 

30 Because of the shortcomings of the hardware 
only and software only approaches, combined soft- 
ware and hardware techniques are becoming avail- 
able. One such approach to the prevention of copy- 
ing places a unique pattern or fingerprint on blank 

35 media, such as floppy discs, for storing tiie pro- 
gram. The program is placed on the disc by the 
manufacturer through software that encrypts tiie 
program source code several times to link tiie 
encrypted program to the unique pattern. The pro- 

40 gram can then be accessed only if the patlem is 
present thus preventing copying of the program. 
However, this, and similar approaches, are limited 
to the media element of the computer system. 
None of the foregoing techniques permit 

45 authorised use, whilst preventing use of the pro- 
gram or software outside limits authorised or estab- 
lished in a software licence. 

US-A-3^)6^2 describes a system that con- 
trols access to information stored In a computer by 

60 means of a portable electronic key device which 
either prevents or allows access to tiie computer. 

JP-A-57-97162 relates to preventing access to 
a central data file. A terminal discriminating and 
processing part determines whetiier a requesting 

55 end user is an authorised user or not Only 
authorised users are permitted access to the files, 
but once in have unlimited use. 

JP-A-58-82355 prevents improper use of porta- 
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bte terminal equipment by registering information 
for preventing improper use. and its permitted fre- 
quency of error. Wlien an error count of input data 
exceeds the previously registered pennnitted emr 
frequency, the equipment is made ineffective. 

The present invention is directed to a software- 
hardware device for controlling access to a main or 
host computer, and the programming contained 
therein, from one or more computer terminals or 
consoles. The access may be controlled in accor- 
dance within limits established in a software 
licence. 

According to the invention there is provided 
apparatus for monitoring the use of software in a 
computer system with respect to at least one se- 
lected aspect of such use, the computer system 
having a central processor containing the software, 
the central processor being accessed by at least 
one operator terminal connected to the central pro- 
cessor; the apparatus comprising receiving means 
coupled to tfie central processor, memory means 
for containing data establishing the ^>ftware usage 
limit for the selected aspect, microprocessor con- 
trol means, and intenrupt means; characterised in 
that the software in the central processor generates 
usage data indicative of monitored software usage 
for the selected aspect of the computer system, 
the apparatus employing at least one pre-estab- 
lished level of occurrences of conditions violating 
the usage limit for the selected aspect when moni- 
toring use of the software; in that the receiving 
means is coupled to the central processor for re- 
ceiving the monitored software usage data from 
software in the central processor; in that the mem- 
ory means contains data establishing the pre-es- 
tablished level of occurrences of violating condi- 
tions, and stores violating condition occurrence 
data ariang from operation of the computer sys- 
tem, and records data indicative of existing usage 
of the monitored software; in that the microproces- 
sor control means is coupled to the receiving 
means an6 to the memory means for determining, 
in response to the usage data, the conditions violat- 
ing said usage limit and for determining whether 
the occurrence of the violating conditions bears a 
predetermined relationship to the established level 
of occurrences of violating conditions; and in that 
the intenrupt means is coupled to the computer 
system and to the control means, and is controlled 
by the control means te provide an output to tiie 
computer system when occurrences of violating 
conditions t>ear the predetermined relationship to 
the established level of occunrences of violating 
conditions, said output operating to control, In ac- 
cordance with the relationship thus determined, the 
use of the software In the computer system in a 
predetermined manner. 

In a typical application of the device, data not 



significant to security, for example data occuning 
during tiie ordinary operation of the computer sys- 
tem, pass unimpeded t)etween tiie central process- 
ing unit and the temninal. When data having signifi- 

5 cance from the security standpoint are sent from a 
tenminal to tiie central processing unit, tfie com- 
puter system will interrogate the security device of 
the present invention. Such data might typically be 
a request to run a particular program. The device 

70 has the use limite permitted by the software licence 
programmed into it tf the request is proper and 
within the limits established by the software 
licence, operation of the program is permitted. If 
the request is not proper, the security device pro- 

75 duces a variety of consequences. For infrequent 
improper requests, operation of the program may 
be permitted, depending on the applications pro- 
gram, but with an appropriate warning displayed on 
the computer tenminal. For frequent improper re- 

20 quests, operation of the program is blocked by tiie 
security device until released by the software own- 
er or supervisory personnel. 

The device of the present Invention, which is 
independent of the central processing unit, thus 

25 monitors program access requests so as to prop- 
erly control access to tiie programs in the central 
processing unit 

By contrast to other approaches to program 
security, the device of the present invention is an 

30 intelligent device having interactive capabilities. For 
this purpose, the device may employ a micro- 
processor. The device is readily auditable to as- 
certain which programs are authorised and the 
limits of that autiiorisation. The device may also 

35 store commerdal data relating to the programs, 
such as the name of the software licensee. The 
authorisation can easily be changed in the field 
through a local terminal or through a remote termi- 
nal connected by a modem. Warning messages 

40 and the like provided by the device can be simi- 
larly changed. 

The device may use units, such as cartridges, 
which can be inserted into the device to penmit 
control of the authorisation of software application 

45 packages or supplier-designated softwaro products, 
such as word proces^ng or graphics programs. 
This provides increased authorisation control, main- 
tainability, and field reliability. For instance, mul- 
tiple software suppliers can control and maintain 

50 use of their products without coordination with otiv 
er software suppliers in a single computer system. 
This Is in contrast to past approaches in which a 
single knowledgeable source of the authorised con- 
figuration must be reached to restore operation of 

55 tiie computer system tolk>wing the fieki failure. 

Emtxxiiments of tiie invention will now be de- 
scribed, by way of example, with reference to the 
accompanying drawings, in which 
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Rg. 1 is a schematic diagram sliowing a soft- 
ware protection device of the present invention 
in a computer system having a centrai process- 
ing unit and one or more terminals; 
Rg. 2 is a schematic diagram showing an alter- 
native connection of the software protection de- 
vice in a computer system; 
Rg. 3 is a schematic block diagram of a soft- 
ware protection device of the present invention 
connected, as shown in Rg. 1, to the central 
processing unit; 

Rgs. 4A and 4B form a flow chart showing 
operation of the software protection device; 
Rg. 5 is a schematic block diagram showing 
details of the software protection device con- 
nected to a computer system in a manner alter- 
native to Rgs. 1 and 2; 

Rg. 6 is a schematic diagram showing details of 
a software protection device of the present in- 
vention suitable for connection to the computer 
system as shown in Rg. 2; and 
Rg. 7 is a schematic diagram showing use of a 
plurality of security devices of the present inven- 
tion to Increase the number of programs that 
can be protected. 

Refening to Rg. 1, a software protection device 
10 of the present invention may be interposed in a 
data signal link or line 12a and 12b between a 
computer terminal 14 and a central processing unit 
16 of a computer system. Other terminals 14a, 14b 
may be connected to the central processing unit 
16. For some types of central processing units, a 
second connection between tiie device 10 and the 
computer 16 may be made by a link or line 18 for 
security purposes because of the particular operat- 
ing system used. The line 18 is connected to an 
additional peripheral port of tiie central processing 
unit 16. Attematively, tt^e device 10 may be con- 
nected to the central processing unit 16 only via 
tiie line 18. as shown in Rg. 2. 

The Internal configuration of the device 10 is 
shown in Rg. 3. The device 10 shown in Rg. 3 is 
suitable for the connection shown in Rg. 1. The 
data signal line 12a from the terminal 14 is coupled 
to a port 50 of tiie device 10. The data signal line 
12b. connected to tiie data port of the central 
processing unit 16. is coupled to a data port 52 of 
tiie device 10. Internal lines 12' and* 12" intercon- 
nect tiie ports 50 and 52 to maintain tiie data signal 
patii between tiie terminal 14 and tiie central pro- 
cessing unit 16. The anrows shown in Rg. 3 sym- 
bolically show tiie flow of data to and from the 
central processing unit 16 and tiie terminal 14. The 
line 12" contains signal level shifters 54 and 56 
which alter tfie signals in the line 12" to levels 
appropriate for the operation of device 10. centrai 
processing unit 16, and terminal 14. Level shifters 
54 and 56 may comprise integrated circuit RS 232 



level shifters, such as that made and sold by 
National Semiconductor Corp.. under tiie model no. 
1488 or 1489. Line 12" also includes an intenrupt 
means 58, shown diagrammatically as a switch 

s operable by controller 60. Intenupt means 58 may 
be operated by controller 60 to cause the display 
of warning messages on terminal 14 in certain 
operating modes of the device and to disable data 
signal lines 12a, 12b under certain conditions of 

10 attempted unauthorized use, as described below, 
from the standpoint of passing nornial data traffic. 

A second pair of intemal data lines 18* and 18" 
are provided in device 10. Lines 18* and 18" are 
connected to port 62 and to security data line 18 

75 leading to the additional peripheral port of centrai 
processing unit 16. The other ends of lines 18* and 
18" may be connected to port 64 ttiat pemnrts 
additional security devices to be connected in se- 
ries w'rth tine device shown in Rg. 3, as shown in 

20 Rg. 7. Data line 18' includes signal level shifters 66 
and 68 similar to level shifters 54 and 56. Data line 
18' also includes an intenupt means 70 operable 
by controller 60 to supply information and com- 
mands to tiie software program in central process- 
es ing unit 16. 

Universal asynchronous receiver-transmitter 72 
has the receiver port connected through level shift- 
er 74 to data line 18". The transmit port is con- 
nected to interrupt means 58 and 70. Receiver- 

30 transmitter 72 may comprise an integrated circuit, 
such as tiiat made and sold by Signetics, as model 
no. SCN2651. 

Controller 60 may be a microprocessor, such 
as that made and sold by the Motorola Corporation. 

35 of PhoOTix, Arizona, under the designation 
MC6809. Watchdog 76 may comprise a monosta- 
ble multivibrator that clocks and resynchronizes 
controller 60 to insure proper operation of controller 
60. 

40 Data bus 78 connects controller 60 to memory 
80. Memory 80 may comprise an electronically 
erasable programmable read only memory 
(EEPROM). Universal asynchronous receiver trans- 
mitter 72 is connected to data bus 78. 

45 Memory 80 contains data relating to tiie op- 
erating system for centrai processing unit 16. !t 
may also contain the data maintenance and operat- 
ing programs for device 10, as well as a map of the 
data contained in cartridges 82 hereinafter de- 

50 scribed. 

Data relating to the programs autiiorized to run 
on the computer system 14-16 Is contained in 
plug-in cartridges 82a, 82b. and 82c. These plug-in 
cartridges may each comprise an electronically 

55 erasable programmable read only memory 
(EEPROM) containing data specific to a particular 
vendor. The EEPROM contains tfie limits of au- 
thorization for the various programs and packages 
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contained in central processing unit 16. A map of 
the data in the cartridge is also included in the 
EEPROM. The cartridges are connected to control- 
ler 60 by data bus 84. 

Device 10 operates as follows, as shown in 
flow chart form in Rg. 4. Device 10 monitors line 
18 from the security port of central processing unit 
16 as at step 100 in Rg. 4 to ascertain the pres- 
ence of Infonmation significant to program security. 
Thus, when a request from terminal 14 to central 
processing unit 16. via the applications software 
program in central processing unit 16, requests 
authorization to run a particular program, the ap- 
plication software in central processing unit 16 will, 
in turn, issue a request in security lines 18 to 
device 10 as at step 102 to inquire whether running 
of the program is authorized. The request will be 
received by universal asynchronous receiver-trans- 
mitter 72 arKi provided to controller 60. Controller 
60 through data bus 84 will interrogate the ap- 
plicable cartridge 82 to obtain the authorization 
data relating to the requested program, as at step 
104. If the request is within the authorization pro- 
vided in tiie software license, controller 60 will 
provide a response through receiver-transmitter 72 
in data bus 18'. 18" to tiie associated port of 
cerrtral processing unit 16 indicating to the com- 
puter system that operation of the program is au- 
thorized. The program is then permitted to run. 
This is shown in Rg. 4 as step 106. 

If the analysis of the request for program au- 
thorization at step 104 indicates that tiie request is 
not within authorized limits, the following operation 
will occur. The applicable cartridge 82 contains 
data relating to tiie number of unautttorized re- 
quests for the program; the time of the last un- 
authorized request; and a moving average of the 
frequency of unauthorized requests. This data is 
intenrogated by controller 60 via data bus 84 at 
steps 107. 108, and 110 of Rg. 3. At tiie same time 
the stored data is updated at steps 112. 114. and 
116. Computation of the moving average may em- 
ploy an exponential smoothing function in which 
latter entries may be related to eariier entries in a 
desired manner to reflect the numt>er of Incidents 
of significance in the average. 

Based on the frequency at which unauthorized 
requests are occurring, one of four Bvents will 
occur in protective device 10. The frequency levels 
at which tiie various events will occur are pro- 
grammed into cartridges 82 by the software sup- 
plier. 

A very low frequency of unauthorized requests 
indicates that the unauthorized requests are prob- 
ably occuning through inadvertency or genuine er- 
ror. For example, a terminal operator may inadver- 
tently request the wrong program. Or. tiie correct 
program may tie requested but at the wrong time. 



If ttie frequency of unautiiorized request is less 
than some predetennined number A programmed 
into tfie applicable cartridge 82. as detennined in 
step 118 of Rg. 4, an error message is sent to 

5 central processing unit 16 from protective device 
10 at step 119 for whatever furtiier action may be 
undertaken by the applications software. The mes- 
sage will be provided from receiver-transmitter 72. 
as controlled by controller 60, and interrupt device 

10 70. The message indicates that a violation has 
occurred but that it is a low level violation. This 
may be termed a L^vel t violation. The applications 
software will typically provide a warning on the 
operator's tenminal screen 14. Ottier typical action 

75 that could be taken by the application software 
might include entry in a master log in central 
processing unit 16 or the provision of a waming 
signal to a supervisory terminal connected to cen- 
tral processing unit 16. Normally the application 

20 software would be permitted to run after the appro- 
priate waming signal has been recorded and/or 
given, as shown in Rg. 4. For Infrequent violations, 
it will t>e appreciated that the operation of device 
10 is basically open loop. Messages are sent to 

2$ central processing unit 16 but no other action is 
taken by device 10. 

If the unauthorized requests are occuning at a 
greater frequency, this may be taken as evidence 
tirat some delit)erate attempt is being made to 

30 obtain unauthorized access to the programs in cen- 
tral pnx:essing unit 16. Step 120 in the flow chart 
of Rg. 4 ascertains that tiie frequency of un- 
autiTorized requests is greater than the tfireshold A 
of step 118 but less ttian some greater frequency 

35 B also programmed into the applicable cartridge 
82. This may be termed a Level II violation. Under 
tills circumstance, an error message is sent to the 
application software in central processing unit 16. 
as at step 121, similar to the action 119 taken for 

40 low frequency violations. However, additionally, a 
timer provided in controller 60 is ^ in operation as 
at step 123. If security device 10 does not receive 
an appropriate response from the software in cen- 
tral processing unit 16. within the time period of the 

45 timer as at step 125 receiver-transmitter 72 pro- 
vides a signal in line 18 from interrupt device 70 to 
disable that particular piece of software from run- 
ning in central processing unit 16 as at step 127. 
The computer system can run ottier software for 

50 which autiiorization is not required or for which 
authorization is properly otrtained. 

If the software in central processing unit does 
provide the appropriate response to protection de- 
vice 10 within the time period of tiie timer, the 

55 software is permitted to run in tifie same manner as 
described in connection with step 118. The addi- 
tional action discussed above would ordinarily be 
taken, such as a waming on terminal screens, entry 
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in master logs, and the tike. The operation of 
device 10 just described is closed loop in that a 
response, or lack thereof, from central processing 
unit 16 back to device 10 is involved in the opera- 
tion. 

If the violation frequency is greater than the 
threshold provided in step 120 but less than some 
higher threshoW C, as determined in step 122 
shown in the flow chart of Rg. 4, receiver-transmit- 
ter 72 and controller 60 operate interrupt device 70 
that acts directly on central processing unit 16 to 
disable the program, as at step 124. Receiver- 
transmitter 72 and controller 60 also operates inter- 
rupt device 58 to send a disable message directly 
from device 10 to terminal 14. as at step 129. This 
is a Level 111 violation. 

For Level 111 violations, operation of the com- 
puter system can only be restored or released by 
the insertion of a key sequence from computer 
tenminal 14 to controller 60 or cartridge 82 as at 
step 126. This could be done by the user's su- 
pervisory personnel. Or it could be done by a field 
service representative of the program supplier, ei- 
ther locally through user's terminal 14 or remote 
from terminal of the supplier connected by a 
modem. 

It should be noted that, at violation Level 111, the 
operation of protection device 10 does not depend 
on the application software in central processing 
unit 16. Rather, protection device 10 operates In- 
dependently on central processing unit 16 to dis- 
able operation of the protected software. 

For very, very frequent violations greater than 
frequency C, that can only indicate delit>erate at- 
tempts to secure unauthorized access to the pro- 
gram, protection device 10 again disables the pro- 
gram in the same manner as descrit)ed in the 
preceding paragraph as at step 128. However, pro- 
tection device 10 will only restore operation of the 
protected software by a key sequence inputted to 
controller 60 from the program supplier's factory, 
as through a modem connected either to central 
processing unit 16 or protective device 10 or from 
tenminal 14, as at step 130. This is temned a Level 
IV violation. 

Data relating to the number of unauthorized 
requests and the time they are occuning indicated 
at steps 114 and 116 in Rg. 4 may be used to 
assist in detecting the source of the unauthorized 
requests. 

In a usual embodiment of software protection 
device 10, the typical data shown in the following 
data table would be provided in each cartridge 82. 
It is anticipated tfiat each cartridge 82 could typi- 
cally be of sufficient storage capacity for the data 
relating up to approximately one hundred software 
packages. The data table is as follows. 
1. Cartridge Related Data 



A. Serial number of cartridge 

B. Cartridge modification count 

C. Cartridge Shipping date 

D. Last cartridge update 

5 E. Date that software authorization will termi- 

nate 

F. Date of warning of impending termination 

G. Run hours warning 

H. Cartridge maintenance data 

10 1. Access validation data (validates access 

to cartridge data) 

2. Modification validation data (validates 
modification) 

I. Warning messages text 

16 J. Owner of software license 

K. Software reseller No. 1 

L Software reseller No. 2 
II. Software Package related data. 

A. kientification of software package 
20 B. Authorization data 

1 . Demonstration package? 

2. NoTMjemonstration package 

a. terminals allowed for this software 
package 

25 b. numi:>er of currently active terminals 

c. number of tenminals authorized 
C. Detection data 
1. Criteria 

a. level required for warning 

30 b. level required for timed disable 

c. level required for temiinal released 
disable 

d. level required for cpu released dis- 
able 

35 2. Occurrence data 

a number of violations 

b. time of last violation 

c. moving average of frequency of vio- 
lations 

40 The foregoing data table provides the data 
necessary for operation of the protective system, 
as well as the necessary control information to the 
software supplier. 

As will be noted from the data table, cartridges 
46 82 may be reprogrammed from terminal 14 to alter 
the limits of authorization. For example, in return 
for increased payments, the limits of authorization 
can be expanded. Any such changes require prop- 
er validation and modification access data or pass- 
so words. 

The application software may t^e transferred to 
another central processing unit by transfening both 
the software and protection device 10 or, at least 
the appropriate cartridge 82. However, if transfer of 
55 the software is attempted without the cartridge 82, 
the software cannot be made to run. 

Rg. 5 shows a device 1 0A of the present 
invention suitable for use with a computer system 
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having only a single data line 12 for both data and 
security information. The configuration of device 
10A generally resembles that of device 10 as 
shown in Rg. 2. Intenrupt means 58 is connected in 
data signal line 12 to disable operation of the 
software and provide messages from receiver- 
transmitter 72 to the screen of terminal 14. 

Rg. 8 shows a device 10B of the present 
invention surtat>le for operating solely through the 
associated additional peripheral port of central pro- 
cessing unit 16. Ail warning and interrupt messages 
are transmitted through this port of the central 
processing unit via ttte line 18. 

Rg. 7 schematically shows use of a plurality of 
software protection devices 10-1. 10-2 and the as- 
sociated intenrupt devices 58 and 70 between ter- 
minal 14 and central processing unit 16. Protection 
devices 10-1 and 10-2 are connected in series on 
security line 18 and/or, if applicable, on data signal 
line 12. The use of additional protection devices 10 
increases the number of software paclcages that 
can be protected. 

Claims 

1. Apparatus (10) for monitoring the use of soft- 
ware in a computer system witii respect to at 
least one selected aspect of such use, the 
computer system having a central processor 
(16) containing the software, the central pro- 
cessor (16) being accessed by at least one 
operator tenminal (14) connected to the central 
processor; the apparahjs (10) comprising re- 
ceiving means (72) coupled to the centra! pro- 
cessor (16), memory means (82) for containing 
data establishing the software usage limit for 
the selected aspect, microprocessor control 
means (60). and intenrupt means (58.70); 
characterised in that the software in the central 
processor (16) generates usage data indicative 
of monitored software usage for the selected 
aspect of the computer system, the apparatus 
employing at least one pre-estabtished level of 
occurrences of conditions violating the usage 
limit for the selected aspect when monitoring 
use of the software; in that ttie receiving 
means (72) is coupled to the central processor 
(18) for receiving the monitored software usage 
data from software in ttie central processor; in 
tiiat ti^e memory means (82) contains data 
establishing the pre-established level of occur- 
rences of violating conditions, and stores vio- 
lating condition occurrence data arising from 
operation of the computer system, and records 
data indicative of existing usage of the mon- 
itored software; in that the microprocessor con- 
trol means (60) is coupled to the receiving 
means (72) and to the memory means (82) for 



determining, in response to ttie usage data, the 
conditions violating said usage limit and for 
determining whether the occurrence of the vio- 
lating conditions bears a predetermined rela- 

5 tionship to the established level of occunences 

of violating conditions; and in that ttie intenoipt 
means (58,70) is coupled to the computer sys- 
tem and to the control means (60), and is 
controlled by the control means to provide an 

70 output to the computer system when occur- 
rences of violating conditions bear the pre- 
determined relationship to the established level 
of occunrences of violating conditions, said out- 
put operating to control, in accordance with the 

75 relationship thus determined, the use of the 
software in the computer system in a predeter- 
mined manner. 

2. Apparatus according to claim 1 for restricting 
20 the use of monitored software in a computer 

system in accordance with a usage limit estab- 
lished for a number of penmitted concunrent 
usages of the monitored software, the central 
processor (16) being accessed by at least two 

25 operator temninals (14) connected to the cen- 
tral processor, wherein the memory means 
(82) contains date establishing ttie software 
usage limit for the number of concurrent us- 
ages of the monitored software and records 

30 date indicative of the concurrent usages of tiie 
monitored software. 

3. Apparatus according to claim 1 or claim 2, 
wherein the intenrupt means (58,70) provides 

35 an output to the computer system for restrict- 
ing use of the monitored software. 

4. Apparatus according to claim 2, wherein the 
concunrent use is evidenced by the number of 

40 operator tenninals concurrentiy using tiie mon- 
itored software and wherein tiie apparatus re- 
stricts use of the monitored software In accor- 
dance with a usage limit established for the 
number of operator terminals (14) permitted to 

45 concurrentiy use the monitored software. 

5w Apparatus according to any preceding claim, 
wherein the memory means (82) contains date 
establishing at least two violative condition oc- 
50 cunrence levels. 

6. Apparatus according to any of claims 1 to 4 
. further defined as employing at least two pre- 
established levels of occurences of conditions 
55 violative of the usage limit for ttie selected 
aspect, wherein the memory means (82) con- 
tains date establishing violative condition oc- 
currence levels and wherein the control means 
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(60) is set to a first state that permits use of 
the monitored software in the central processor 
(16) or to a second stale that restricts use of 
the monitored software, the control means (60) 
changing from the first state to the second s 
state when the occurrence of violative con- 
ditions t»ears a predetermined relationship to a 
violative condition occunrence level, the control 
means (60) being capable of being reset from 
the second state to the first state by remotely io 
generated resetting instructions, and wherein 
the Intenrupt means (58.70) provides an output 
to the computer system when the control 
means (60) is in the second state for restricting 
use of the monitored software. is 

7. Apparatus according to any preceding claim, 
wherein the control means (60) and Interrupt 
means (58.70) provide a signal indicating im- 
proper usage requests to the software in the ao 
central processor (16) upon the existence of a 
first occunrence level. 

& Apparatus according to any preceding claim 
wherein the control means (60) and Intenupt 25 
means (58,70) prevent the monitored software 
from operating in the central processor (16) 
upon the existance of a second occurrence 
level. 



9. Apparatus according to any preceding claim, 
wherein the memory means (82) contains data 
establishing levels in the frequency of violative 
condition occurences. 

10. Apparatus according to claim 9, further com- 
prising timing means In the control means (60) 
operable when the frequency of a violative 
condition occurence exceeds a predetermined 
level and requiring a timely response from the 
central processor (16) to avoid operating the 
intenrupt means (58,70). 

11. Apparatus according to claim 10, wherein the 
timing means have a predetermined timing in- 
terval, the timing means commencing a timing 
interval when the frequency of a violative con- 
dition occurrences exceeds a pre-established 
level, ttw control means (60) and interrupt 
means (58.70) providing a signal to the soft- 
ware in tfie centi-al processor (16) indicating 
commencement of the timing interval and pro- 
viding a signal preventing tiie monitored soft- 
ware from operating in the central processor 
(16) unless a response is received from the 
central processor within tiie timing Interval of 
the timer. 



12. Apparatus according to any of tiie preceding 
claims wherein ttie control means (60) is set to 
a first stale that permits use of software in the 
central processor (16) or to a second state that 
restricts use of software, and wherein the con- 
trol means (60) can fc>e reset from tiie second 
state to tiie first state. 

13. Apparatus according to any preceding claim, 
further Including transmitter means coupled to 
the control means and to tiie intemipt means 
for transmitting warning signals generated by 
the control means to the central processor. 

14. Apparatus according to any one of claims 1 to 

12, wherein the interrupt means is coupled to 
at least one operator tenminai. tiie apparatus 
furttier including transmitter means (72) coup- 
led to the control means and to the interrupt 
means for transmitting warning signals gen- 
erated by the control means to at least one of 
tfie the operator temninal and central proces- 
sor. 

15. Apparatus according to any preceding claim 
wherein tiie interrupt means (58,70) is coupled 
to tfie central processor (18) by means of a 
data signal link (12) and wherein the receiver 
means (72) is coupled to tiie data signal link 
(12). 

16. Apparatus according to any one of claims 1 to 

13, wherein tiie centi-al processor of tiie com- 
puter system has a security agnal link (18) 

35 and wherein tiie intenrupt means (58,70) and 
receiver means are coupled to tiie security 
signal link (18) of tiie central processor (16). 

17. Apparatus according to any one of claims 1 to 
40 13. wherein tiie central processor (16) of tfie 

computer system has a security signal link (18) 
and has a data signal link (12). wherein the 
interrupt means includes means (58) coupled 
to ttie data signal link (12) and means (70) 
45 coupled to tiie security signal link (18), and 
wherein the receiving means is coupled to the 
security signal link. 

18. Apparatus according to claim 16 or claim 17, 
60 wherein tfie transmitter means (72) are coupled 

to the security signal link. 

19. Apparatus according to claim 18, wherein the 
transmitter means is connected to tiie data 

55 signal link. 

20. Apparatus according to any preceding claim, 
wherein the memory means (82) is contained 
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in an element removable from the apparatus. 

21. Apparatus according to any preceding claim, 
wherein the memory means (82) further com- 
prises programmable memory means in which s 
the data of the memory means may be altered. 

22. Apparatus according to claim 21, wherein the 
memory means (82) comprises an EEPROM. 

10 

23b Apparatus according to any preceding claim, 
wherein the central processor (16) of the com- 
puter system has an operating system and 
wherein the apparatus further includes addi- 
tional memory means (80) coupled to the con- w 
trol means containing data relating to the op- 
erating system of the central processor (16). 

24. Apparatus according to claim 20, wherein the 
additional memory means (80) comprises an 20 
EEPROM. 

25. Apparatus according to any preceding claim, 
wherein the receiving means and the interrupt 
means (72) include means for connecting an 25 
additional software use monitoring apparatus in 
series therewith, the apparatus further includ- 
ing a plurality of software monitoring ap- 
paratuses connected in series for monitoring 
additional software in the computer system. 30 

Revendlcations 

1. Dispositif (10) pour contr6ler I'emploi d'un logi- 
del dans un syst^me de traitement de Tinfor- 35 
mation en ce qui conceme au moins un aspect 
seiectionn^ de cet emploi, !e syst^me de trai- 
tement de rinformation comportant un proces- 
seur central (16) contenant le loglcie!, Vacdbs 
etant fait au processeur central (16) par au 40 
moins un tenminal d'operateur (14) connect^ 
au processeur central; le dispositif (10) com- 
prenant un moyen ricepteur (72) coupid au 
processeur central (16), un moyen k m^moire 
(82) pour contenir des donnees ^tablissant la 45 
limite d'usage du logiciel pour I'aspect s^lec- 
tionne, un moyen contrdleur h microproces- 
seur (60), et un moyen intenxipteur (58,70); 
caract§ris4 en ce que le logidel inclus dans le 
processeur central (16) g§n§re des donn^ so 
d'usage indiquant un usage du logiciel contro- 
ls pour I'aspect selectionne du syst^me de 
traitement de I'information, le dispositif mettant 
en oeuvre au moins un niveau pr^tabli d'ap- 
parttions de conditions violent la limite d'usage 55 
pour I'aspect sSlectionnS pendant un contrdle 
de remploi du logiciel; en ce que le moyen 
rScepteur (72) est coupl6 au processeur cen- 



tral (16) pour recevoir les donnSes d'usage du 
logiciel contr6le en provenance du logidel in- 
clus dans le processeur central; en ce que le 
moyen a mSmoire (82) contlent des donnSes 
etablissant le niveau preStabii d'apparltions de 
conditions de violation, el memorise des don- 
nees d'apparition de conditions de violation 
r^ultant du fonctionnement du systeme de 
traitement de I'lnfonmation, et enregistre des 
donnSes Indiquant I'usage existant du logidel 
contrdid; en ce que le moyen contrdleur li 
microprocesseur (60) est coupiS au moyen r§- 
cepteur (72) et au moyen k mSmdre (82) pour 
dStennniner, en reponse aux donn^ d'usage. 
les conditions violant ladite limite d'usage et 
pour determiner si I'apparition des conditions 
de violation comporte un rapport pr^dStenminS 
vis-^-vis du niveau Stabll d'apparitions de 
conditions de violation; et en ce que le moyen 
intenrupteur (58.70) est coupIS au syst§me de 
traitement de rinformation et au moyen contrd- 
leur (60), et est command^ par le moyen 
contrdleur pour foumir un signal de sortie au 
systeme de traitement de rinformation quand 
les apparitions de conditions de violation corn- 
portent un rapport prSdSterminS vis-^-vis du 
niveau Stabli d'apparitions de conditions de 
violation, iedit signal de sortie agissant pour 
commander, selon le rapport ainsi determine, 
I'emploi du logiciel dans le systeme de traite- 
ment de I'lnfonmation d'une manlere predeter- 
mine. 

2. Dispositif selon la revendication 1, pour limiter 
remploi du logidel controie dans un syst§me 
de traitement de rinfonnation conformement k 
une limite d'usage Stabile pour un certain nom- 
bre d'usages concurrents admis du logidel 
controls, I'acc^s au processeur central (16) 
etant fait par au moins deux terminaux d'cpS- 
rateur (14) connectSs au processeur central, 
dans lequel le moyen k mSmdre (82) contient 
des donnSes Stablissant la limite d'usage du 
logidel pour le nombre d'usages concurrents 
du logidel contrdtS et enregistre des donnees 
indiquant les usages concunrents du logidel 
contrdle. 

3. Dispositif selon I'une quelconque des revendl- 
cations 1 et 2, dans lequel le moyen interrup- 
teur (58,70) foumit un signal de sortie au sys- 
teme de traitement de rinformation pour limiter 
I'emploi du logiciel contrdlS. 

4. Dispositif selon la revendication 2. dans lequel 
rempld concunrent est mis en evidence par le 
nombre de terminaux d'opSrateur employant 
en concunrence le logidel contrdlS et dans 
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lequel le dispositif limrte Tempbi du (ogictei 
control^ conform^ment h une limite d'usage 
^tablie pour le nombre de tenminaux d'opera- 
teur (14) admis employer en concurrence le 
iogiciel control^. s 

5. Dispositif selon I'une quelconque des revendi- 
cations 1 h 4, dans lequel le moyen k m^moi- 
re (82) contient des donn§es ^tablissant au 
moins deux niveaux d'apparition de conditions io 
de violation. 

8. Dispositif selon I'une quelconque des revendi- 
cations 1 & 4, d^fini en outre comme metlant 
en oeuvre au moins deux niveaux pr^6tablis is 
d'apparitions de conditions violant la limite 
d'usage pour Taspect sdlectionnS. dans lequel 
le moyen k memoire (82) contient des don- 
n^es etablissant des niveaux d'apparition de 
conditions de violation et dans lequel le moyen 20 
controleur (60) est mis a un premier 4tat qui 
penmet Temploi du Iogiciel contr6l6 dans le 
processeur central (16) ou h un second etat 
qui limite I'empioi du Iogiciel contrdl^, le 
moyen contrdleur (60) passant du premier etat 25 
au second dtat quand {'apparition de conditions 
de violation comporte un rapport predetermine 
vis-^-vis d'un niveau d'apparition de conditions 
de violation, le moyen controleur (60) pcuvant 
etre remis du second ^tat au premier etat par 30 
des instructions de remise k I'etat initial g6n§- 
ries k distance, et dans lequel le moyen inter- 
rupleur (58.70) foumit un signal de sortie au 
systlme de traitement de I'lnformation quand 
le moyen controleur (60) est dans le second 35 
etat pour limtter I'empioi du logidel control^. 

7. Dispositif selon Tune quelconque des revendl- 
cations 1^6, dans lequel le moyen contr6leur 
(60) et le moyen intenrupteur (58,70) foumis- 40 
sent un signal indiquant des demandes d'usa- 
ge incon^ctes au Iogiciel inclus dans le pro- 
cesseur central (16) au cours de i'existence 
d'un premier niveau d'apparition. 



a Dispositif selon i'une quelconque des revendi- 
cations 1 k 7. dans lequel le moyen controleur 
(60) et le moyen interrupteur (58.70) emp§- 
chent le Iogiciel contrdl^ d'agir dans le proces- 
seur central (16) au cours de I'existence d'un 
deuxi&me niveau d'apparition. 

9- Dispositif selon I'une quelconque des revendi- 
cations 1^8, dans lequel le moyen k memoi- 
re (82) contient des donnSes Etablissant des 
niveaux dans la frequence des apparitions de 
conditions de violation. 



10. Dispositif selon la revendication 9, comprenant 
en outre un moyen de synchronisation dans le 
moyen controleur (60) pouvant fonctionner 
quand la frequence d'apparition de conditions 
de violation depasse un niveau predetermine 
et exigeant une r^ponse synchronisee du pro- 
cesseur central (16) pour eviter le fonctionne- 
ment du moyen Intenrupteur (58.70). 

11. Dispositif selon la revendication 10, dans le- 
quel le moyen de synchronisation comporte un 
intervalle de synchronisation predetermine, le 
moyen de synchronisation commengant un in- 
tervalle de synchronisation quand la frequence 
d'apparition des conditions de violation depas- 
se un niveau preetabli. le moyen controleur 
(60) et le moyen intenrupteur (58.70) foumis- 
sant un signal au Iogiciel inclus dans le pro- 
cesseur central (16) indiquant le commence- 
ment de I'intervalle de synchronisation et four- 
nissant un signal empichant le logidel contro- 
le d'agir dans le processeur central (16) k 
moins qu'une reponse soit regue du proces- 
seur central dans I'intervalle de synchronisa- 
tion du moyen de synchronisation. 

12. Dispositif selon I'une quelconque des revendi- 
cations 1 Si 11. dans lequel le moyen contro- 
leur (60) est mis k un premier etat qui permet 
I'empioi du logidel daris le processeur central 
(16) ou a un second etat qui limite I'empioi du 
logidel. et dans lequel le moyen contr6leur 
(60) peut etre remis du second etat au premier 
etat 

13. Dispositif selon I'une quelconque des revendi- 
calions 1 ^ 12. incluant en outre un moyen 
emetteur coupie au moyen controleur et au 
moyen intenrupteur pour emettre des signaux 
d'avertissement engendres par le moyen 
controleur vers le processeur central. 

14. Dispositif selon I'une quelconque des revendi- 
cations 1 k 12, dans lequel le moyen intenrup- 

45 teur est couple k au moins un terminal d'ope- 
rateur, le dispositif inciuant en outre un moyen 
emetteur (72) coupie au moyen controleur et 
au moyen interrupteur pour emettre des si- 
gnaux d'avertissement engendres par le 
50 moyen contrdleur vers au moins un du termi- 
nal d'operateur et du processeur central. 

15. Dispositif selon Tune quelconque des revendi- 
cations 1 ^ 14. dans lequel le moyen intenrup- 

55 teur (58,70) est coupie au processeur central 
(16) au moyen d'une liaison pour signaux de 
donnees (12) et dans lequel le moyen recep- 
teur (72) est coupie k la liaison pous signaux 
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de donn^es (12). 

16. Disposrtif selon Tune quelconque des revendi- 
cab'ons 1 k 13. dans lequel le processeur 
central du syst§me de traitement de rinformsr s 
tion comporte une liaison pour signaux de 

curitS (18) et dans lequel le moyen Intenupteur 
(58,70) et le moyen rdcepteur sont couples h 
la liaison pour signaux de securite (18) du 
processeur central (16). w 

17. Dispositif selon Tune quelconque des revendi- 
cations 1 ^ 13. dans lequel ie processeur 
central (16) du syst^me de traitement de Pin- 
formation comporte une liaison pour signaux 76 
de securite (18) et comporte une liaison pour 
signaux de donn^es (12), dans lequel le 
moyen intenupteur comprend un moyen (58) 
couple k la liaison pour signaux de donn^es 

(12) et un moyen (70) coupid k la liaison pour 20 
signaux de sprite (18), et dans lequel le 
moyen r^cepteur est coupli h la liaison pour 
signaux de securite. 

ia Dispositif selon Tune quelconque des revendi- 25 
cations 16 et 17, dans lequel le moyen emet- 
teur (72) est coupl^ k la liaison pour signaux 
de securite. 

19. Dispositif selon la revendication 18, dans le- so 
quel le moyen emetteur est connect^ h la 
liaison pour signaux de donn^es. 

20. Dispositif selon Tune quelconque des revendi- 
cations 1 a 19, dans lequel le moyen h ft\& 35 
moire (82) est contenu dans un 6l6ment amo- 
vible du dispositif. 

21. Dispositif selon Tune quelconque des revendi- 
cab'ons 1 & 20^ dans lequel le moyen h m4- 40 
moire (82) comprend en outre un moyen h 
m^moire programmable dans lequel les don- 
n^es du moyen k m^moire peuvent §tre modi- 
fi^es. 

45 

22. Dispositif selon la revendication 21, dans le- 
quel le moyen k m^moire (82) comprend une 
m^moire morte programmable effa^able elec- 
triquement (EEPROM). 

50 

23. Dispositif selon Tune quelconque des revendi- 
cations 1 k 22, dans lequel ie processeur 
central (16) du syst&me de traitement de Pin- 
formation comporte un systlme d'exploitation 

et dans lequel le dispositif inciut en outre un 66 
moyen k m^moire supplementaire (80) coupl^ 
au moyen controleur contenant des donn^es 
relatives au syst^me d'exploitation du proces- 



seur central (16). 

24. Dispositif selon la revendication 20, dans le- 
quel le moyen k memoire supplementaire (80) 
comprend une m§moire EEPROM. 

25. Dispositif selon Tune quelconque des revendi- 
cations 1 k 24, dans lequel le moyen r§cepteur 
et le moyen interrupteur (72) comprennent des 
moyens pour connecter un dispositif de 
contrdle de Pemploi d'un logiciel supplemen- 
taire en serie avec ceux-ci, le dispositif in- 
duant en outre un ensemble de dispositifs de 
contrdle de logiciel connectes en s^rie pour 
contrdler le logiciel supplementaire dans le 
syst§me de traitement de ['information. 

PatentansprUche 

1, Vorrichtung (10) zum Ol>erprtJfen der Verwen- 
dung einer Software in einem Computersystem 
bezUglich wenigstens einem ausgew§hlten 
Venwendungsaspekt, wobei das Computersy- 
stem einen Zentralprozessor (16) mit der Soft- 
ware aufweist sowie mindestens eine mit dem 
Zentralprozessor vert>undene Bedienungs-Da- 
tenstation (14). die zugriff auf den Zentralpro- 
zessor hat, und wotjei die Vorrichtung (10) ein 
mit dem Zentralprozessor (16) verbundenes 
Empfangsmittel (72) hat ein Speichermittel 
(82), das Daten, die die Software-Verwen- 
dungsgrenze fOr den ausgewShlten Aspekt be- 
grUnden, enthalt sowie ein Mikroprozessor- 
Steuermittel (60) und ein Unterbrechungsmittel 
(58, 70), dadurch gekennzeichnet, da6 die 
Software In dem Zentralprozessor (16) Verwen- 
dungsdaten erzeugt, die fOr die OberprOfte 
Software-Venivendung fOr den ausgewahlten 
Aspefct des Computersystems bezelchnend 
sind, wobei die Vonichtung, wenn die Verwen- 
dung der Software Dt>erprQft wird, wenigstens 
ein voreingestelltes Niveau von Vorkommen 
von Bedingungen t^nutzt, die die Verwen- 
dungsgrenze fOr den ausgewahlten Aspekt ver- 
letzen; 6bB das Empfangsmittel (72) mit dem 
Zentralprozessor (16) vertMjnden ist zum Emp- 
fang der at)erprQften Software-VenArendungs- 
daten von der Software in den Zentralprozes- 
sor; daB das Speichermittel (82) Daten enthMlt. 
die das vorelngestellte Niveau von Vorkommen 
von verietzenden Bedingungen etablieren, und 
das Speichermittel die verietzenden 
Bedingungsvorkommen-Daten, die mit dem 
Betrieb des Computersystems entstehen, spei- 
chert sowie die Daten abspeichert die fQr die 
bestehende Venvendung der (IberprOften Soft- 
ware bezelchnend sind; 6aB das 
Mikroprozessor-Steuermittel (60) mit dem 
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Empfangsmittel (72) und dem Speichermittel 
(82) verbunden ist. urn in Reaktion auf die 
Verwendungsdalen die Bedingungen zu be- 
stimmen, die die Verwendungsgrenze verlet- 
zen. und zur Bestimmung, ob das Vorkommen 
der verietzenden Bedingungen einen Bezug 
hat auf eine vorbestimmte Beziehung zu dem 
aufgestellten Niveau von Vorkommen von ver- 
ietzenden Bedingungen; und daB das Unter- 
brechungsmittel (58. 70) mit dem Computersy- 
stem und dem Steuenmrttel (60) verbunden ist 
und von dem Steuermittel gesteuert wird, um 
eine Ausgabe an das Computersystem zu 
schaffen, wenn die Vorkommen der verietzen- 
den Bedingungen einen Bezug haben auf die 
vorbestimmte Beziehung zu dem aufgestellten 
Niveau der Vorkommen von verietzenden Be- 
dingungen, wobei die Ausgabe so ark^itet dafi 
gemaiS der so t)estimmten Beziehung die Ver- 
wendung der Software in dem Computersy- 
stem in einer vorbestimmten Weise gesteuert 
wird. 

2- Vonichtung nach Anspruch 1 fOr die Bn- 
schrankung der Verwendung der OberprOften 
Software in einem Computersystem entspre- 
chend einer Verwendungsgrenze, die fUr eine 
Anzahl von erlaubten, gleichzeitigen Venwen- 
dungen der GberprQften Software enichtet ist, 
wobei auf den Zentratprozessor (16) wenig- 
stens zwel Bedienungs-Datenstationen (1 4) 
Zugriff haben. worin das Speichermittel (82) 
Daten enthSIt, die die Software-Verwendungs- 
grenze fOr eine Anzahl von gleichzettigen Ver- 
wendungen der OberprOften Software begrOn- 
den, und Daten speichert, die fOr die gleichzen 
tigen Verwendungen der OberprOften Software 
t)ezeichnend sind. 

3. Vonichtung nach Anspruch 1 Oder Anspruch 2, 
worin das Untert)rechungsmittel (58, 70) eine 
Ausgabe an das Computersystem schafft, um 
die Verwendung der OberprOften Software zu 
beschrSnken. 

4. Vorrichtung nach Anspruch 2, worin die gleich- 
zeitige Verwendung an der Zahl der 
Bedienungs-Datenstationen erkennbar ist, die 
gleichzeitig die OberprOfte Software benutzen, 
und worin die Vonichtung die Ven^vendung der 
OberprOften Software beschrSnkt gemafi einer 
Verwendungsgrenze, die fOr die Zahl der 
Bedienungs-Datenstationen (14) enichtet ist, 
welche gleichzeitig die Qt>erprOfte Software be- 
nutzen dOrfen. 

& Vorrichtung nach einem der vorangehenden 
Ansprilche, worin das Speichenmittel (82) Da- 



ten enthart. die wenigstens zwei Niveaus von 
verietzenden Bedingungsvori<ommen begrOn- 
den. 

5 6- Vonichtung nach einem der AnsprOche 1 bis 4 
und femer definiert durch die Venwendung von 
wenigstens zwei voreingestellten Niveaus von 
Voricommen von Bedingungen, die die Venfven- 
dungsgrenze fOr den ausgewahlten Aspekt ver- 

10 letzen. worin das Speichemrtittel (82) Daten 
enthalt. die Niveaus von verietzenden Bedin- 
gungsvoritommen begrilnden. und worin das 
Speichenmitlel (60) auf einen ersten Zustand 
eingesteirt ist. der die Verwendung der Ober- 

75 prOften Software in dem Zentralprozessor (16) 
eriaubt, Oder auf einen zweiten Zustand. der 
die Verwendung der OberprOften Software be- 
schrMnkt. wobei die Steuervonrichtung (60) von 
dem ersten In den zweiten Zustand wechselt, 

20 wenn das Vorkommen von verietzenden Bedin- 
gungen einen Bezug hat auf eine vort)estimm- 
te Beziehung zu einem Niveau von verietzen- 
den Bedingungsvorkommen. und das Steuer- 
mittel (60) von dem zweiten Zustand In den 

26 ersten Zustand durch femerzeugte RQcksetzin- 
stnjktionen zurOckversetzt werden kann. und 
worin das Unterbrechungsmittel (58, 70) eine 
Ausgat)e an das Computersystem schafft, 
wenn das Steuenmittel (60) in dem zweften 

30 Zustand Ist zur Beschrankung der Verwendung 

der OberprOften Software. 

7. Vorrichtung nach einem der vorangehenden 
AnsprOche. worin das Steuermittel (60) und 
36 das Unterbrechungsmittel (58, 70) bei Voriie- 

gen eines ersten Vorkommenniveaus ein Si- 
gnal schafft, das eine falsche Verwendungsan- 
frage an die Software in dem Zentralprozessor 
(16) anzeigt. 

40 

a Vorrichtung nach einem der vorangehenden 
AnsprOche, worin das Steuermittel (60) und 
das Unterbrechungsmittel (58, 70) bei Voriie- 
gen eines zweiten Vorkommenniveaus die 
45 OberprOfte Software daran hindert in dem Zen- 
tralprozessor (16) zu arbelten. 

9, Vonichtung nach einem der vorangehenden 
Ansprilche, worin das Speichenmittel (82) Da- 

50 ten enthalt, die Niveaus in der Frequenz von 
verietzenden Bedingungsvoricommen t)egrOn- 
den. 

10. Vorrichtung nach Anspruch 9, die femer in 
55 dem Steuermittel (60) ein Zeitmittel aufwelst, 

das betriebs^hig ist, wenn die Frequenz eines 
verietzenden Bedingungsvoricommens ein vor- 
bestimmtes Niveau Oberschreltet, und die eine 

13 
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Zettantwort aus dem Zentralprozessor (16) be- 
notigt. urn den Betrieb des Unterbrechungsmrt- 
teis (58. 70) 2u vermeiden. 

11. Vorrichtung nach Anspruch 10. worin das Zert- 
mittel ein vorbestimmtes Zeitintervall hat wo- 
bei das Zeitmlttel ein Zeitintervall starlet wenn 
die Frequenz von verletzenden Bedingungsvor- 
kommen ein vort>estimmtes Niveau Qberschre*- 
tet wobei das Steuennitlel (60) und das Unter- 
brechungsmittel (58, 70) ein Signal an die Scaft- 
ware in dem Zentralprozessor (16) bereitstellt 
das den Start des Zeltintervalls anzeigt und 
ein Signal schafft das d^ Betrieb der Ober- 
prOften Software in dem Zentralprozessor (16) 
vertiindert bis eine Antwort von dem Zentral- 
prozessor Innerhalb des Zeltintervalls des Zett- 
gebers empfangen wird. 

12. Vorrichtung nach einem der vorangehenden 
AnsprOche. worin das Steuemnittel (60) auf el- 
nen ersten Zustand eingesteitt ist der die Ver- 
wendung der Software in derh Zentralprozes- 
sor (16) erlaubt oder auf einen zweften Zu- 
stand, der die Verwendung der Software be- 
schrlnkt und worin das Steuennittel (60) von 
dem zweiten Zustand in den ersten Zustand 
zurOckgestellt werden kann. 

ia Vorrichtung nach einem der vorangehenden 
AnsprOche, die femer ein Sendemittel aufweist, 
das mit dem Steuenmitlel und dem UnteriDre- 
chungsmittel verbunden ist ft3r die Obersen- 
dung von Wamsignalen, die von dem Steuer- 
mittel erzeugt werden. an den 2^ntralprozes- 
sor. 

14^ Vorrichtung nach einem der AnsprOche 1 bis 

12, worin das Unterbrechungsmittel mit wenig- 
stens einer Bedienungs-Datenstation verbun- 
den ist, wobei die Vonichtung femer ein Sen- 
demittel (72) aufweist das mit dem Steuennit- 
tel und dem Unterbrechungsmittel verbunden 
ist fur die Obermittlung von Wamsignalen, die 
von dem Steuennittel erzeugt werden, an we- 
nigstens einen der Bedienungs-Datenstationen 
und den Zentralprozessor. 

15. Vomchtung nach einem der vorangehenden 
AnsprOche. worin das Unterbrechungsmittel 
(58. 70) durch eine Datensignalveri^indung (12) 
mit dem Zentralprozessor (16) veriDunden ist 
und worin das Empfangsmittel (72) mit der 
Datenstgnalverbindung (12) verbunden ist. 

16. Vorrichtung nach einem der AnsprOche 1 bis 

13, worin der Zentralprozessor des Computer- 
systems eine SIcheriieitssignaiverbindung (18) 



hat und worin das Unterbrechungsmittel (58, 
70) und das Empfangsmittel mit der Sicher- 
heitssignalverbindung (18) des Zentralprozes- 
sors (16) vertHinden sind. 

5 

17. Vomchtung nach einem der AnsprOche 1 bis 
13, worin der Zentralprozessor (16) des Com- 
putersystems eine Sicherheitssignalverblndung 
(18) und dne Datenslgnalverbindung (12) hat, 

TO worin das Unterbrechungsmittel ein Mittel (58), 
das mit der Datensignatverbindung (12) ver- 
bunden ist, und ein Mittel (70). das mit der 
Sicherheitssignalveribindung (18) verbunden ist. 
aufweist und worin das Empfangsmittel mit 

16 der Sicherheitssignalverfoindung verbunden ist 

ia Vorrichtung nach Anspruch 16 oder Anspruch 
17. worin das Sendemittel (72) mit der Sicher- 
heitssignalverbindung verbunden ist 

20 

19- Vorrichtung nach Anspruch 18, worin das Sen- 
demittel mit der Datenslgnalverbindung ver- 
bunden ist 

26 20. Vorrichtung nach einem der vorangehenden 
AnsprOche. worin das Spek:hermlttel (82) in 
einem Element angeordnet 1st das aus der 
Vonichtung entfembar ist 

30 21. Vorrichtung nach einem der vorangehenden 
AnsprOche, worin das Speichermittel (82) fer- 
ner ein programmierbares Speichemnittel auf- 
weist, in dem die Daten des Speichenmrttels 
geandert werden kdnnen. 

35 

22. Vorrichtung nach Anspruch 21, worin das Spei- 
chermittel (82) einen EEPROM aufweist 

23. Vorrichtung nach einem der vorangehenden 
40 AnsprOche. worin der Zentralprozessor (16) 

des Computersystems ein Betriebssystem hat, 
und worin die Vorrichtung femer ein zusatzli- 
ches Speichermittel (80) aufweist. das mit dem 
Steuermitlel vertxinden ist und Daten bezOg- 
45 lich des Betriebssystems des Zentralprozes- 
sors (16) enthalt 

24. Vorrichtung nach Anspruch 20, worin das zu- 
satzliche Speichermittel (80) einen EEPROM 

50 aufweist 

25. Vorrichtung nach einem der vorangehenden 
AnsprOche, worin das Empfangsmittel und das 
Unterbrechungsmittel (72) ein Mittel aufwelsen, 

55 um eine zusStzliche Softwarevenvendungs- 
OberprOfungsvom'chtung damit in Serie zu 
schalten. wobei die Vorrichtung femer mehrere 
Software-UberprOfungsvomchtungen aufweist 
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die in Serie geschaitet sind, fOr die Oberpru- 
fung von zusatzlicher Software in dem Compu- 
tersystem. 
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